There are several types of network appliances that communicate flows of packets. In one example, the network appliance is a switch or router through which a plurality of client network devices interconnect to the Internet. A great many different flows, which may be as many as one million flows, may pass through such a network appliance. In order to be able to direct packets of these many flows in various ways within the network appliance in an efficient manner, the network appliance must generally determine the application protocol type of the packets of each flow. Accordingly, the network appliance performs deep packet inspection on a packet of each flow and thereby determines various things about the flow, including the application protocol type of the flow. Performing this deep packet inspection is slow and may limit the performance of the network appliance, but knowing the application protocol type is often necessary in order to otherwise optimize performance of the network appliance.